Lemongrass3110

5 exploits Active since Sep 2025
CVE-2025-58447 WRITEUP CRITICAL WRITEUP
rAthena <commit 2f5248b - Buffer Overflow
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversized token length. This leads to immediate denial of service (crash) and it is possible to achieve remote code execution via heap corruption. Commit 2f5248b fixes the issue.
CVSS 9.8
CVE-2025-58448 WRITEUP CRITICAL WRITEUP
rAthena <commit 0d89ae0 - SQL Injection
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue.
CVSS 9.1
CVE-2025-58750 WRITEUP HIGH WRITEUP
rAthena <commit 0cc348b - Memory Corruption
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixed in commit 0cc348b.
CVSS 8.2
CVE-2025-62170 WRITEUP HIGH WRITEUP
rAthena < 2025-10-12 - Unauthenticated Use-After-Free in RODEX Functionality
rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of service by crashing the map-server. This issue has been patched in commit af2f3ba. There are no known workarounds aside from manually applying the patch.
CVSS 7.5
CVE-2025-62797 WRITEUP HIGH WRITEUP
FluxCP - Cross-Site Request Forgery via Session Cookie Authorization
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c.